# authmanager

**Repository Path**: secretflow_admin/authmanager

## Basic Information

- **Project Name**: authmanager
- **Description**: No description available
- **Primary Language**: Python
- **License**: Apache-2.0
- **Default Branch**: main
- **Homepage**: None
- **GVP Project**: No

## Statistics

- **Stars**: 0
- **Forks**: 0
- **Created**: 2024-01-15
- **Last Updated**: 2024-01-15

## Categories & Tags

**Categories**: Uncategorized

**Tags**: None

## README

[![CircleCI](https://dl.circleci.com/status-badge/img/gh/secretflow/authmanager/tree/main.svg?style=svg)](https://dl.circleci.com/status-badge/redirect/gh/secretflow/authmanager/tree/main)

# AuthManager

AuthManager is an Authorization Management Service, which is designed to manage metadata of user data and authorization information. 

## Features

- AuthManager runs on the Intel SGX Machine, it will be remote attested by the user who uploads data to ensure that the AuthManager has no malicious behavior
- AuthManager uses signatures or mac, digital envelopes, etc. to prevent communication data from being tampered, and it also supports mtls
- AuthManager manages the data encryption keys and meta-informations. All services which want to get these information must be verified to have the authorization to obtain the data encryption keys and meta-informations, ensuring that the authorization semantics cannot be bypassed
- AuthManager supports flexible authorization semantics

## Build And Run By Source Code

there are two modes in the AuthManager: simulation mode, production mode

### Prepare

- First of all, we need to generate dynamic link library, libgeneration.so and libverification.
- Then, we need to move two librarys to the directory "second_party/unified_attestation/c/lib/"

so how to generate dynamic link library?

- get submodule in the current directory

```bash
git clone xxx
git submodule init
git submodule update --init --remote --recursive
```

- compile source code to get the above two dynamic link librarys

```bash
# create docker image
bash sgx2-env
# enter docker image
bash sgx2-env enter
# compile dynamic librarys
bash second_party/unified_attestation/compile.sh
```

### Simulation Mode

Remote Attestation is not enabled for this mode

```bash
# build exe and occlum
cargo build
# 
# enable tls(often skip)
# if you want to use the mtls, you can refer to the mtls part
# run service
# if the port is occupied, you can modify the field port in the config.yaml
LD_LIBRARY_PATH=/home/admin/dev/second_party/unified_attestation/c/lib/ target/debug/auth-manager --config_path=deployment/conf/config.yaml --enable-tls=false
```

### Production Mode(default mode)

Remote Attestation is enabled for this mode
NOTICE: if you modify any field in the configuration file in occlum release, you must execute command "occlum build -f --sign-key <path_to/your_key.pem>"

```bash
# build exe and occlum
bash deployment/build.sh
# 
cd occlum_release
# enable tls(often skip)
# if you want to use the mtls, you can refer to the mtls part
# connect to pccs service
modify /etc/sgx_default_qcnl.conf PCCS_UR
modify image/etc/kubetee/unified_attestation.json ua_dcap_pccs_url
# Generate a pair of public and private keys
occlum build -f --sign-key <path_to/your_key.pem>
# run service
occlum run /bin/auth-manager --config_path /host/config.yaml --enable-tls=false
```

## Run Quickly by Docker Image

there are two kinds of docker images, corresponding to simulation mode and production mode

### Simulation Mode Image

```bash
# pull docker image
docker pull xxxx
# enter docker image
sudo docker run -it --net host xxxx
#
cd occlum_release
# enable tls(often skip)
# if you want to use the mtls, you can refer to the mtls part
# run service
occlum run /bin/auth-manager --config_path /host/config.yaml --enable-tls=false
```

### Production Mode Image

```bash
# pull docker image
docker pull xxxx
# enter docker image
sudo docker run -it --net host -v /dev/sgx_enclave:/dev/sgx/enclave -v /dev/sgx_provision:/dev/sgx/provision --privileged=true xxxx
#
cd occlum_release
# enable tls(often skip)
# if you want to use the mtls, you can refer to the mtls part
# connect to pccs service
modify /etc/sgx_default_qcnl.conf PCCS_UR
modify occlum_release/image/etc/kubetee/unified_attestation.json ua_dcap_pccs_url
# Generate a pair of public and private keys
occlum build -f --sign-key <path_to/your_key.pem>
# run service
occlum run /bin/auth-manager --config_path /host/config.yaml --enable-tls=false
```

## Mutual Tls

you must generate certificate if you want to use mtls feature of AuthManager

- for AuthManager, all certificates should be put in the directory whose path is ”auth-manager/resources“
- for AuthManager, the required certificates are the Server Key, the Server Certificate, and the Client CA Certificate which is used to verify the Client Certificate
- for Client, the required certificates are the Client Key, the Client Certificate, and the Server CA Certificate which is used to verify the Server Certificate
- for AuthManager, you should modify the field server_cert_path, server_cert_key_path and client_ca_cert_path in the configuration file named config.yaml
- when all is ready, you can enable mtls by modifying the field enable_tls in the the configuration file named config.yaml to true

## Contributing

Please check [CONTRIBUTING.md](CONTRIBUTING.md)

## License

This project is licensed under the [Apache License](LICENSE)